CMMC Practice IA.L1-3.5.1

Identify information system users, processes acting on behalf of users, or devices.

Monarch ISC Guidance

Similar to the very first practice in Access Control, you must assign a unique username and password to users who will be accessing DoD information, CUI, etc. This also refers to unique service account names, host names, and infrastructure device identifiers. The organizational policy must state that all users have a unique username and password, and all devices are uniquely identified. Your plan will describe how you manage these credentials, such as using Active Directory. You will need to review/audit the list of users and hosts on a scheduled basis for level four maturity.

Security Catapult

Be prepared for CMMC

Our Q&A assessment tool is designed by security advisors for MSPs and DoD contractors of all sizes.

Try now for free

Security Catapult

Understand your gaps

See compliance gaps, compliance scores and proactive security tasks in a single interface.

Try now for free

Security Catapult

Validate NIST SP 800-171

Based on your CMMC answers, we let you know where you stand on NIST.

Try now for free

Security Catapult

Build a plan of action

Track your burn down and stay on top of security needs.

Try now for free

Security Catapult

Build your policy

Say goodbye to maintaining a security policy. We do it for you.

Try now for free

Discussion From Source

DRAFT NIST SP 800-171 R2 Common device identifiers include media access control (MAC), Internet protocol (IP) addresses, or device-unique token identifiers. Management of individual identifiers is not applicable to shared system accounts. Typically, individual identifiers are the user names associated with the system accounts assigned to those individuals. Organizations may require unique identification of individuals in group accounts or for detailed accountability of individual activity. In addition, this requirement addresses individual identifiers that are not necessarily associated with system accounts. Organizational devices requiring identification may be defined by type, by device, or by a combination of type/device. NIST SP 800-63-3 provides guidance on digital identities.